Data security

How we protect your account and your information.

Effective date: October 5, 2026

This page describes the security measures we actually have in place. We are a small online school and do not hold any formal security certification. No system is perfectly secure, but we work to keep your information safe.

Encryption

Our website is served only over HTTPS, so information moving between your browser and our site is encrypted. Our database provider, Neon, requires encrypted (TLS) connections and states that it encrypts stored data at rest using AES-256.

Passwords and sign-in

Passwords are stored only as a bcrypt hash. We cannot read your password, and our staff never ask for it.
You set or reset your password through a link emailed to you.
Sign-in sessions expire after 24 hours. We can sign an account out of every device at once, for example after a change of role.
You can also choose to sign in with Google, where we offer it.

Who can see what

Every account has a role: student, instructor or administrator. Students see only their own courses, progress and results. Instructors see only the courses they are assigned to, and can change only certain parts of them. Administrators run the school.

These permissions are checked on our server for every protected request, against the role currently stored in our database, not just against what the screen shows. If someone’s role is removed, they lose access straight away.

Audit trail

When staff grant, extend or remove a student’s course access, we record who did it, for which student, when, and the reason.

Payments

Card payments are handled by Stripe on Stripe’s own payment page. Your card number never reaches our servers and we never store it. We confirm payments using Stripe’s signed notifications, so an order cannot be marked as paid by someone outside Stripe.

Assessments

Graded assessments run inside Safe Exam Browser. Our server checks that each request comes from the approved Safe Exam Browser configuration before it accepts the attempt.

Uploaded files

Files such as résumés and photos are stored with Vercel Blob. Each file is given a long, random web address that is not linked from anywhere on our site.

To be completed by the school: uploaded files are currently stored at unlisted but public addresses, meaning anyone who has the exact link can open the file. Decide whether résumés should be moved to private storage.

How we run the site

Passwords and keys for our services are kept in protected environment settings on our hosting provider, not in our code.
Our database provider keeps backups of our data, as described in its own documentation.

To be completed by the school: the backup restore window for the school’s database plan, whether administrator accounts use two-factor authentication, and the steps you will take if a data breach happens (including notifying affected people and the Privacy Commissioner, as PIPEDA requires).

How you can help

Use a strong password you do not use anywhere else.
Never share your login.
Sign out when you use a shared computer.
Be careful of emails asking for your password. We will never ask for it.

Reporting a security problem

If you think you have found a security weakness on our website, please tell us privately at info@uscanadataxschool.com. Include enough detail for us to reproduce it. Please do not access other people’s data, disrupt the service, or make the problem public before we have had a chance to fix it. We will acknowledge your report and keep you informed.

More information

See our privacy policy for what we collect and your rights, and our terms.